Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter
mediumThe Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated attackers to manipulate whi...
- CVSS:
- 5.3
- Affected:
- up to 2.1.0
- Fixed in:
- 2.1.1
- Disclosed:
- Jan 16, 2026